Skip to content

enable oidc publishing #1015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
travi merged 45 commits into from
Oct 16, 2025
Merged

enable oidc publishing #1015

travi merged 45 commits into from
Oct 16, 2025

Conversation

@travi
Copy link
Member

@travi travi commented Oct 14, 2025 •
edited
Loading

this doesnt yet handle:

  • publishing to an alternative registry from a custom pkgRoot because of the added dry-run
  • including node v24 in the verification matrix on ci (but i have separately confirmed that the released version works fine in v24)

travi added 19 commits July 8, 2025 23:49
@travi
ci(release): enable triggering for the alpha branch
eba6518
@travi
fix(deps): depend on the oidc branch for npm
733fe89
@travi
fix(token): temporarily disable configuring token into .npmrc
73185a3 
since oidc removes the need for the token

for #958
@travi
fix(whoami): temporarily disable verifying token validity
0fc050d 
since oidc does not currently work for whoami

for #958
@travi
fix: raise the minimum semantic-release requirement to v25
156b6c8 
BREAKING CHANGE: v25 of semantic-release is now expected

for #958
@travi
Revert "fix: raise the minimum semantic-release requirement to v25"
65dffca 
This reverts commit 156b6c8.
@travi
fix(deps): depend on the released version of the cli branch now that …
fc30c21 
…the oidc features are merged
@travi
feat(auth): attempt a dry-run publish to determine auth status
841dc67
@travi
fix(auth): throw error if dry-run publish determines lack of auth
8f88e9d
@travi
fix(error): throw an aggregate error rather than a simple error
1967d72
@travi
fix(stdout): fix the reference of stdout from execa
4ab3e74
@travi
fix(dry-run): look for the warning in stderr output rather than stdout
86f65a6
@travi
fix(dry-run): stop searching for "warn" to avoid ANSI color complicat…
bee5db6 
…ions
@travi
docs(oidc): update the authentication details to include recommending…
9bdfd06 
… oidc
@travi
feat(auth-error): updated messaging for auth failure to be less token…
e24967d 
… specific
@travi
fix(auth): throw appropriate error when auth context fails to enable …
f5c8d85 
…publishing
@travi
feat(verify-auth): configure npmrc details again
bd7acfb
@travi
Merge branch 'beta' of github.com:semantic-release/npm into alpha
197693e
@travi
Merge branch 'master' of github.com:semantic-release/npm into alpha
761d4db
@github-actions
Copy link

github-actions bot commented Oct 14, 2025

🎉 This PR is included in version 13.1.0-alpha.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 14, 2025

🎉 This PR is included in version 13.1.0-alpha.3 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.8 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.9 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.10 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.11 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.12 🎉

The release is available on:

Your semantic-release bot 📦🚀

@github-actions
Copy link

github-actions bot commented Oct 15, 2025

🎉 This PR is included in version 13.1.0-alpha.13 🎉

The release is available on:

Your semantic-release bot 📦🚀

travi added 3 commits October 15, 2025 15:01
@travi
docs(trusted-publishing): add details to the readme for configuring w…
e5c9857 
…ithin GitLab Pipelines

for #958
@travi
refactor: resolve prettier issues
38b0466
@travi
ci(node-versions): disable node v24 from the verification matrix for now
d351eca 
since stubbing `@actions/core` breaks in that version and i don't want figuring that out to delay
getting the trusted-publishing feature out

for #958
@travi travi changed the base branch from master to beta October 16, 2025 03:08
@travi travi marked this pull request as ready for review October 16, 2025 03:09
@travi
Copy link
Member Author

travi commented Oct 16, 2025 •
edited by hearts bot
Loading

i'm going to go ahead and promote this to beta status. we can do a proper review before promoting to stable, but i want to signal that this is now production quality and ready for community testing by promoting to beta. there are still a few details to get buttoned up, but those changes can be applied to the beta

@travi travi merged commit a160d8d into beta Oct 16, 2025
2 of 6 checks passed
@travi travi deleted the alpha branch October 16, 2025 03:11
@github-actions
Copy link

github-actions bot commented Oct 16, 2025

🎉 This PR is included in version 13.1.0-beta.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

@travi travi mentioned this pull request Oct 16, 2025
Merged
@github-actions
Copy link

github-actions bot commented Oct 19, 2025

🎉 This PR is included in version 13.1.0 🎉

The release is available on:

Your semantic-release bot 📦🚀

kennyjpowers pushed a commit to kennyjpowers/claude-flow that referenced this pull request Nov 22, 2025
@kennyjpriester @claude
fix: update semantic-release to latest with OIDC support
0440f6a 
Update semantic-release from v22.0.0 to v25.0.2 and @semantic-release/npm
to v13.1.2 which includes OIDC trusted publishing support (merged Oct 2025).

This enables token-free publishing via npm Trusted Publishers without
requiring NPM_TOKEN environment variable.

References:
- semantic-release/npm#1015 (enable oidc publishing)
- semantic-release/npm#1017 (promote to stable)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
claudeflow-release bot pushed a commit to kennyjpowers/claude-flow that referenced this pull request Nov 22, 2025
@semantic-release-bot
chore(release): 1.1.0 [skip ci]
4b7847b 
# [1.1.0](v1.0.1...v1.1.0) (2025-11-22)

### Bug Fixes

* enable npm provenance for OIDC publishing ([4ded4fc](4ded4fc))
* update Node version requirements for semantic-release v25 ([ddc22fa](ddc22fa))
* update semantic-release to latest with OIDC support ([0440f6a](0440f6a)), closes [semantic-release/npm#1015](semantic-release/npm#1015) [semantic-release/npm#1017](semantic-release/npm#1017)
* use npm install instead of npm ci for complex dependencies ([22ebc10](22ebc10))

### Features

* enable OIDC publishing and remove token workflow ([5d1f195](5d1f195))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

released on @alpha released on @beta released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@travi